An adaptive risk defense method, apparatus, device, and medium

Abstract

This invention provides an adaptive risk defense method, apparatus, device, and medium, relating to the field of information network security technology. It involves acquiring operational data of an information system; predicting the dynamic baseline of the operational data using a dynamic baseline model; determining abnormal detection data of the operational data using a multi-dimensional anomaly detection model based on the dynamic baseline; and determining corresponding response measures based on the anomaly detection data. This improves detection accuracy, increases the sensing range, and ensures both attack suppression and business continuity.

Description

Technical Field

[0001] This invention relates to the field of information network security technology, and more specifically, to an adaptive risk defense method, apparatus, device, and medium. Background Technology

[0002] With the rapid development of cloud computing, the Internet of Things (IoT), and the Industrial Internet, the operational data streams generated by information systems are becoming increasingly massive, and the increasing complexity of business models is accompanied by an increase in various covert attacks. Common defense methods mainly include detection methods based on static thresholds. Simple CPU utilization thresholds and access request thresholds cannot adapt to dynamic business characteristics, resulting in high false positive and false negative rates. Baseline models built based on simple statistical dynamic thresholds, such as moving averages and standard deviations, are susceptible to noise and sudden traffic interference, leading to unstable detection. Most solutions with single detection dimensions only analyze a single indicator (such as traffic or access count), lacking the ability to comprehensively correlate multi-dimensional data (logs, user behavior sequences, network topology, etc.). Rigid response strategies directly trigger blocking based on most detection results, lacking flexible responses based on risk classification, which has a significant impact on normal business operations. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide an adaptive risk defense method, apparatus, device and medium to improve detection accuracy, increase the sensing range and ensure the suppression of attacks and the continuity of business.

[0004] Firstly, this application provides an adaptive risk defense method, including:

[0005] Obtain operational data from the information system;

[0006] Based on operational data, a dynamic baseline model is used to predict the dynamic baseline of the operational data. The dynamic baseline model is as follows: based on the operational data, the trend characteristics, seasonal characteristics, and residual characteristics of the operational data are determined; based on the trend characteristics and residual characteristics, the conditional mean of the operational data is determined; based on the residual characteristics, the conditional variance of the operational data is determined; and based on the conditional mean and conditional variance, the dynamic baseline at the current moment is obtained.

[0007] Based on a dynamic baseline, a multi-dimensional anomaly detection model is used to determine the anomaly detection data of the running data. The multi-dimensional anomaly detection model is as follows: a global detection sub-model determines the global point anomaly features of the running data; a local detection sub-model determines the contextual anomaly features of the running data; a mean detection sub-model determines the collective anomaly features of the running data; and the anomaly detection data of the running data is determined based on the global point anomaly features, contextual anomaly features, and collective anomaly features.

[0008] Based on the anomaly detection data, determine the corresponding response measures.

[0009] Optionally, the adaptive risk defense method provided in this application further includes:

[0010] Feedback information was received; the feedback information was obtained by annotating the abnormal detection data that issued the alarm.

[0011] Based on the feedback information, update the weights and thresholds in the dynamic baseline model and the multi-dimensional anomaly detection model.

[0012] Optionally, based on the operational data, a dynamic baseline model is used to predict the dynamic baseline of the operational data, including:

[0013] The trend features of the operational data are extracted by the local weighted regression scatter smoothing sub-model, the seasonal features of the operational data are extracted by the cyclic subsequence smoothing sub-model, and the residual features are determined based on the operational data, trend features, and seasonal features.

[0014] Based on trend and residual characteristics, an exponentially weighted moving average sub-model is used to predict the conditional mean of the running data at the next time step.

[0015] Based on the residual characteristics, a generalized autoregressive conditional heteroscedastic sub-model is used to predict the conditional variance of the running data at the next time step.

[0016] Based on the conditional mean and conditional variance, a Gaussian distribution is used to obtain the dynamic baseline of the running data at the current moment.

[0017] Optionally, based on a dynamic baseline, a multi-dimensional anomaly detection model is used to determine anomaly detection data for the operational data, including:

[0018] The average path length of the running data is determined by randomly selecting features and segmentation points. Based on the average path length and normalization factor, the global point anomaly features of the running data are determined.

[0019] The local density value of the running data is determined by K-nearest neighbors, and the contextual anomaly characteristics of the running data are determined based on the local density value and the average local density of the neighbors.

[0020] The cumulative deviation value of the multi-window runtime data is determined by using dynamic baselines and multi-window methods. Based on the cumulative deviation value of the multi-window runtime data, the collective anomaly characteristics of the runtime data are determined.

[0021] Based on global point anomaly features, context anomaly features, and collective anomaly features, anomaly detection data for runtime data is determined.

[0022] Optionally, based on global point anomaly features, contextual anomaly features, and collective anomaly features, anomaly detection data for the runtime data is determined, including:

[0023] Based on global point anomaly features, context anomaly features, and collective anomaly features, the first risk data and first decision result of global point anomaly features, the second risk data and second decision result of context anomaly features, and the third risk data and third decision result of collective anomaly features are determined.

[0024] Based on the first risk data and first weight, the second risk data and second weight, and the third risk data and third weight, the final risk data of the operational data is determined.

[0025] Based on the first decision result and first weight, the second decision result and second weight, the third decision result and third weight, and the decision threshold, the final decision result of the running data is determined;

[0026] Based on the final risk data and the final decision results, anomaly detection data for the operational data are determined.

[0027] Optionally, based on the anomaly detection data, determine the corresponding response measures, including:

[0028] When the final decision result in the anomaly detection data is determined to be anomaly, and the final risk data in the anomaly detection data is at the first threshold, the response measure is blocking.

[0029] When the final decision result in the anomaly detection data is determined to be anomaly, and the final risk data in the anomaly detection data is at the second threshold, the response measure is flow restriction.

[0030] When the final decision result in the anomaly detection data is determined to be anomaly, and the final risk data in the anomaly detection data is at the third threshold, the response measure is an early warning.

[0031] When the final decision result in the anomaly detection data is determined to be anomaly, and the final risk data in the anomaly detection data is at the fourth threshold, the response measure is monitoring only.

[0032] Secondly, this application provides an adaptive risk defense device, comprising:

[0033] The data acquisition module is used to acquire operational data of the information system;

[0034] The dynamic baseline module is used to predict the dynamic baseline of operational data using a dynamic baseline model. The dynamic baseline model is as follows: based on the operational data, it determines the trend characteristics, seasonal characteristics, and residual characteristics of the operational data; based on the trend characteristics and residual characteristics, it determines the conditional mean of the operational data; based on the residual characteristics, it determines the conditional variance of the operational data; and based on the conditional mean and conditional variance, it obtains the dynamic baseline at the current moment.

[0035] The data detection module is used to determine the anomaly detection data of the running data based on a dynamic baseline and a multi-dimensional anomaly detection model. The multi-dimensional anomaly detection model is as follows: it determines the global point anomaly features of the running data through a global detection sub-model; it determines the contextual anomaly features of the running data through a local detection sub-model; it determines the collective anomaly features of the running data through a mean detection sub-model; and it determines the anomaly detection data of the running data based on the global point anomaly features, contextual anomaly features, and collective anomaly features.

[0036] The anomaly handling module is used to determine the corresponding response measures based on the anomaly detection data.

[0037] Optionally, the adaptive risk defense device provided in this application further includes:

[0038] The feedback optimization module is used to receive feedback information, which is obtained by labeling the anomaly detection data that issued the alarm. Based on the feedback information, the module updates the weights and thresholds in the dynamic baseline model and the multi-dimensional anomaly detection model.

[0039] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the aforementioned adaptive risk defense method when executing the computer program.

[0040] Fourthly, this application provides a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the aforementioned adaptive risk defense method.

[0041] This invention provides an adaptive risk defense method, apparatus, device, and medium that acquires operational data of an information system; based on the operational data, a dynamic baseline model is used to predict the dynamic baseline of the operational data; based on the dynamic baseline, a multi-dimensional anomaly detection model is used to determine anomaly detection data of the operational data; based on the anomaly detection data, corresponding response measures are determined to improve detection accuracy, increase the perception range, and ensure the suppression of attacks and the continuity of business.

[0042] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0043] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 A flowchart of an adaptive risk defense method provided by an embodiment of the present invention is shown;

[0045] Figure 2 A schematic diagram of the structure of an adaptive risk defense device provided in an embodiment of the present invention is shown;

[0046] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present invention is shown. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0048] To facilitate a better understanding of this application by those skilled in the art, the technical terms used in this application will be briefly introduced below.

[0049] Information systems are digital systems that defend against risks (such as business failures, network attacks, and resource overload) by monitoring operational data. They have collectable operational data (such as performance indicators, logs, and traffic) and need to adapt to dynamic business changes in order to accurately identify anomalies.

[0050] Performance metrics are various quantitative data generated during the operation of information systems or services. They are used to measure the health status of the system and resource usage. Performance metrics include, but are not limited to, CPU utilization, memory usage, disk I / O throughput, access request threshold, input / output bytes of network interfaces, database query response time, application service error rate, latency, and concurrent connections. They are key to reflecting the internal operating status of the system. Abnormal performance fluctuations are often a direct manifestation of attacks (such as DDoS and resource exhaustion attacks) or failures.

[0051] Log data (user behavior logs) records all user operations and activity traces within the system. It is typically used to analyze user behavior and includes, but is not limited to, user login / logout time, IP address, number of failed login attempts, files, directories, database tables accessed by the user, commands or operations executed by the user (such as file upload, download, modification, and deletion), user access frequency, path, and session duration. Analyzing user behavior is a core method for detecting advanced persistent threats (APTs) such as insider threats, account theft, and lateral movement. For example, an employee who normally only accesses files in a specific department suddenly starting to traverse the entire server is a high-risk anomaly.

[0052] Network traffic is traffic data captured by traffic probes, including but not limited to total inbound / outbound bytes or packets, protocol distribution (proportional distribution of protocols such as TCP, UDP, and ICMP), port distribution (usage of source / destination ports), connection characteristics (number of new connections, connection duration, connection success rate), session information (source / destination IP addresses, source / destination ports, protocol type, packet size, transmission direction), and application layer characteristics such as HTTP request methods (GET / POST), URLs, User-Agent, and DNS query records. Network traffic is a primary data source for detecting external intrusions, malicious scanning, data breaches, botnet communications, and other attacks. By analyzing traffic patterns, covert and slow-moving attack behaviors can be identified.

[0053] The term "and / or" used in this application describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A existing alone, A and B existing simultaneously, and B existing alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0054] After introducing the technical terms used in this application, the technical solution provided in this application will be described in detail below.

[0055] This application provides an adaptive risk defense method, see below. Figure 1As shown, the general flow of the adaptive risk defense method provided in this application embodiment is as follows:

[0056] Step 110: Obtain the operating data of the information system.

[0057] In this embodiment, the operational data includes, but is not limited to, core parameters of operational data such as performance metrics, log data, and network traffic, in order to achieve accurate detection of complex attacks.

[0058] Furthermore, after acquiring the operational data of the information system, the process also includes: preprocessing and grouping the operational data. First, operational data from different sources is converted to a unified format to avoid errors or failures in subsequent processing due to format differences. For example, heterogeneous data such as server CPU data, network traffic data, and application logs (e.g., numerical, character, or timestamp formats) are converted to a unified format (e.g., timestamps accurate to the second or indicator values ​​are unified as numerical). Then, the unified formatted operational data undergoes missing value processing using interpolation or model prediction methods to prevent missing values ​​from affecting the continuity of the time series. Random noise in the operational data is removed through smoothing to preserve the true trend and periodic characteristics of the operational data, providing a clean data foundation for subsequent processing. Finally, the processed operational data can be grouped using time windows. The time window can be determined based on the fluctuation frequency of the business data, and different indicator data can be processed according to the time window to obtain structured data groups with timestamps and multiple indicator values.

[0059] Step 120: Based on the operational data, use a dynamic baseline model to predict the dynamic baseline of the operational data; wherein, the dynamic baseline model is: based on the operational data, determine the trend characteristics, seasonal characteristics and residual characteristics of the operational data; based on the trend characteristics and residual characteristics, determine the conditional mean of the operational data; based on the residual characteristics, determine the conditional variance of the operational data; based on the conditional mean and conditional variance, obtain the dynamic baseline at the current time.

[0060] To eliminate the incompatibility of static thresholds with dynamic systems, embodiments of this application predict the dynamic baseline of the running data at any time through a dynamic baseline model, thereby realizing an anomaly detection baseline that can dynamically change with time and business load.

[0061] The embodiments of this application predict the dynamic baseline of the operating data in the following ways: extracting the trend features of the operating data through a local weighted regression scatter smoothing sub-model, extracting the seasonal features of the operating data through a cyclic subsequence smoothing sub-model, and determining the residual features based on the operating data, trend features, and seasonal features; predicting the conditional mean of the operating data at the next time step using an exponentially weighted moving average sub-model based on the trend features and residual features; predicting the conditional variance of the operating data at the next time step using a generalized autoregressive conditional heteroscedasticity sub-model based on the residual features; and obtaining the dynamic baseline of the operating data at the current time step using a Gaussian distribution based on the conditional mean and conditional variance.

[0062] Furthermore, the dynamic baseline model is a dynamic probability distribution that evolves over time and whose volatility varies over time; that is, the dynamic baseline model can predict running data at any time t. The conditional probability distribution it follows In the formula, This refers to all historical running data up to time t-1. In this embodiment, the conditional probability distribution of the dynamic baseline model can be implemented using a Gaussian distribution, which is... In the formula, For conditional mean, This represents the conditional variance.

[0063] In this embodiment of the application, the Gaussian distribution of the dynamic baseline model can be determined through the following process:

[0064] First, by employing the local regression method of seasonal decomposition (STL, Seasonal and Trend decomposition using Loess), any time series (i.e., running data) can be analyzed. It is decomposed into three additive components, namely ,in, As a trend feature, Seasonal characteristics, The residual features are as follows: Trend features can be extracted from the running data using a locally weighted regression scatter smoothing sub-model. Trend features represent the long-term, non-periodic macroscopic change direction in the sequence and determine the sensitivity of trend tracking. Seasonal features can be extracted iteratively from the running data using a cyclic sub-sequence smoothing sub-model. Seasonal features represent the repetition within a fixed period (e.g., 24 hours or 7 days) and the seasonality that changes over time (e.g., the weekend effect gradually intensifies). The residual features are the random fluctuations remaining after removing the trend and seasonal features from the running data, which are considered approximately stationary. Ideally, the residual feature is a stationary process with zero mean and variance that may change over time. For example, by setting the period to t (e.g., daily period t=1440 minutes), STL continuously optimizes the trend features, seasonal features and residual features of each running data through inner and outer loop iterations to ensure the accuracy of feature extraction, thereby enabling the model to resist outlier interference and ultimately support the dynamic baseline to accurately characterize the normal state of the information system.

[0065] Secondly, the conditional mean of the running data is predicted using an Exponentially Weighted Moving Average (EWMA) model that assigns higher weights to recent observations. Specifically, an exponentially weighted moving average sub-model is used to predict trend and residual characteristics. Conditional mean at the next time step Specifically, the mathematical form of the exponentially weighted moving average algorithm is a first-order autorecursive filter:

[0066]

[0067] In the formula, As a smoothing factor, These are the observations from the previous time step after removing seasonal features. This is the weighted average of the values ​​from the previous time step; where, This can be optimized by maximizing the likelihood estimate or minimizing the sum of squared one-step prediction errors. For sequences with large fluctuations, this approach is particularly useful. Larger values ​​are used to quickly track changes; for stable sequences, Take the smaller value to smooth out the noise. The specific values ​​can be customized.

[0068] Then, the time-varying volatility of the residual characteristics is characterized and predicted using a Generalized Autoregressive Conditional Heteroskedasticity (GARCH) model, where the GARCH model is:

[0069]

[0070] In the formula, For conditional variance, As a smoothing factor, The actual residual characteristics at time t-1 All of these are model parameters, and must satisfy the following conditions: To ensure stationarity, conditional variance From the long-term average variance level The unexpected shock of the previous issue (in GARCH) ) and the previous period's prediction variance (GARCH term) It consists of three parts; among which, model parameters It can be obtained through maximum likelihood estimation, for example, assuming Then the log-likelihood function is:

[0071]

[0072] In the formula, T is the sample length, which is maximized through numerical optimization (such as the quasi-Newton optimization algorithm (BFGS, Broyden-Fletcher-Goldfarb-Shanno algorithm)). The parameters can then be estimated.

[0073] Finally, the conditional mean and conditional variance Combined, they form a Gaussian distribution. ), which serves as the dynamic baseline for the current moment.

[0074] Dynamic baselines are obtained by processing operational data through a dynamic baseline model to solve the problem of static threshold rigidity, thereby enhancing the logical closed loop.

[0075] For example, monitoring the API request volume per minute of a campus course selection website system when it is open. Decomposed using the STL algorithm This results in a slow, upward trend that reflects the natural growth of the business. A complex waveform with a period of 1440 minutes (one day) exhibiting seasonal characteristics (including morning troughs, midday mini-peaks, evening peaks, and seasonal variations in overall amplitude increase over the weekend). and residual features after removing trend and seasonal features Prediction using the EWMA model conditional mean Assuming the starting time of the open course selection is... Request volume A sudden surge, EWMA model (assuming) = 0.2) will respond quickly In the calculation, The weight is 0.2. The weight is , The weight is And so on, the weights are updated over time and with recent surges in data to adjust the baseline mean. Rapidly adjust the settings to avoid generating a large number of false alarms during periods of high concurrency in course selection; use a GARCH model for prediction. conditional variance of At the moment course selection began, residuals It will be abnormally large, leading to Very large, according to the GARCH model Volatility prediction for the next moment It will immediately jump to a very high level. Therefore, the dynamic threshold for anomaly detection... The width of the [value] will adaptively increase, and the system will enter a high-fluctuation warning mode, tolerating greater deviations. As the activity progresses, the fluctuations tend to stabilize. It will gradually decrease and the sensitivity will recover, thus solving the problem of avoiding false alarms without losing real anomalies when business fluctuates drastically.

[0076] It should be noted that the dynamic baseline is the anomaly detection baseline. The dynamic baseline is a dynamic reference standard used to determine whether the running data is abnormal, and it is also used to define the boundary between normal and abnormal running data during anomaly detection.

[0077] Step 130: Based on the dynamic baseline, a multi-dimensional anomaly detection model is used to determine the anomaly detection data of the running data; wherein, the multi-dimensional anomaly detection model is to determine the global point anomaly features of the running data through a global detection sub-model; to determine the contextual anomaly features of the running data through a local detection sub-model; to determine the collective anomaly features of the running data through a mean detection sub-model; and to determine the anomaly detection data of the running data based on the global point anomaly features, contextual anomaly features, and collective anomaly features.

[0078] In this embodiment of the application, based on a dynamic baseline, a multi-dimensional anomaly detection model is used to determine the anomaly detection data of the running data, including:

[0079] The average path length of the running data is determined by randomly selecting features and segmentation points. Based on the average path length and normalization factor, the global point anomaly features of the running data are determined. The local density value of the running data is determined by K-nearest neighbors. Based on the local density value and the average local density of its neighbors, the contextual anomaly features of the running data are determined. The cumulative deviation value of the multi-window running data is determined by dynamic baseline and multi-window. Based on the cumulative deviation value of the multi-window running data, the collective anomaly features of the running data are determined. Based on the global point anomaly features, contextual anomaly features, and collective anomaly features, the anomaly detection data of the running data is determined.

[0080] Furthermore, the methods for determining anomaly detection data for operational data include, but are not limited to, the following: based on global point anomaly features, context anomaly features, and collective anomaly features, determining the first risk data and first decision result for global point anomaly features, the second risk data and second decision result for context anomaly features, and the third risk data and third decision result for collective anomaly features; based on the first risk data and first weight, the second risk data and second weight, and the third risk data and third weight, determining the final risk data for operational data; based on the first decision result and first weight, the second decision result and second weight, the third decision result and third weight, and a decision threshold, determining the final decision result for operational data; and based on the final risk data and the final decision result, determining the anomaly detection data for operational data.

[0081] To avoid biases caused by a single algorithm detecting runtime data, this application embodiment employs a multi-dimensional anomaly detection model that integrates parallel multi-model detection and decision fusion to achieve full-spectrum anomaly detection. This balances the detection capabilities for different types of anomalies, improving both accuracy and recall. Specifically, based on a dynamic baseline, the multi-dimensional anomaly detection model is used to determine the specific overview of anomaly detection data in the runtime data, as follows:

[0082] First, the running data is detected using parallel sub-models of the Isolation Forest Detection, Density Classical Algorithm, and Multi-Window Detection in the multi-dimensional anomaly detection model. Global point anomaly features, contextual anomaly features, and collective anomaly features are obtained to identify different types of anomaly data under different data distributions and scales, thereby improving detection accuracy. Specifically, the Isolation Forest Detection sub-model uses randomly selected features and split points to construct multiple binary trees (iTrees) to form an isolated forest. The path length of each individual tree in the isolated forest is then calculated, and based on the path lengths of all individual trees... Determine the average path length for isolated forests The outlier score of an isolated forest is determined by the following formula, based on the average path length and normalization factor: :

[0083]

[0084] In the formula, The normalization factor can be determined based on the theoretical value of the average path length of a sample in an ideal isolated tree containing n samples.

[0085] Based on anomaly scores, global point anomaly characteristics of the runtime data are determined. Where, if the anomaly score... The closer the score is to 1, the shorter the average path length, and the easier it is to isolate the data, thus increasing the probability that the data corresponding to the outlier score is an anomaly; if the outlier score... The closer it is to 0, the longer the average path length, and the closer it is to the characteristics of normal samples, thus the higher the probability that the running data corresponding to the abnormal score is normal.

[0086] By employing classic density algorithms (such as the Local Outlier Factor (LOF) detection algorithm) using Euclidean distance, Manhattan distance, etc., the distances between each data point in the test data and all other data points in the test data are calculated. These distances are sorted from smallest to largest, and the samples corresponding to the top K distances are taken as the K nearest neighbors of the data point P in the test data. The distance of the farthest sample among the K nearest neighbors to the data point P is recorded, thus determining the local environmental range of the data point P. Based on the K nearest neighbors, points O among the K nearest neighbors of data point P are determined, and the reachable distance between data point P and point O is calculated. The reachable distance is the larger of the K nearest neighbor distance of point O and the actual distance between data point P and point O, to avoid misjudging the density of data point P as too low due to point O being located in a low-density region. The local reachable density of each K nearest neighbor point O of data point P is calculated separately. The system determines the average local reachability of a data point P based on its local reachability, and also calculates the local reachability of P itself. The average local reachability of P's neighbors is divided by P's own local reachability; the resulting ratio is the Local Outlier Factor Score (LOF). Based on the LOF, the system identifies contextual anomalies in the data. If the LOF is close to 1, P is considered normal data. If the LOF is much greater than 1, P's local density is significantly lower than its neighbors, indicating significant sparseness in the local environment and thus anomalies in context. If the LOF is greater than 1, P's local density is significantly higher than its neighbors, indicating a locally dense normal point. This process identifies anomalous data within a local context.

[0087] The detection sub-model uses the conditional mean and conditional variance as a dynamic baseline to determine core parameters such as tolerance, alarm threshold, and window duration. Tolerance refers to the allowable range of small fluctuations between the running data and the dynamic baseline; the alarm threshold is the upper limit of the cumulative deviation; and the window duration can be set to three parallel windows: fast, medium, and slow. The running data to be detected at each time point is calculated using the following formulas. Cumulative deviation value in a single window The cumulative deviation values ​​Sfast(t), Smedium(t), and Sslow(t) of the fast window, are obtained:

[0088]

[0089] In the formula, This is the cumulative deviation value from the previous moment. For tolerance, it is generally taken as 0.5 times the standard deviation of the dynamic baseline condition σ(t); where, when When the preset alarm threshold is exceeded, the operating data is determined to be abnormal and... Reset to 0;

[0090] Based on the cumulative deviation values ​​Sfast(t) of the fast window, Smedium(t) of the medium window, and Sslow(t) of the slow window, the collective anomaly characteristics of the running data are determined; if the cumulative deviation value Sfast(t) of the fast window is triggered (i.e. If the deviation value exceeds the alarm threshold, it indicates a short-term rapid drift (such as a sudden but continuous small increase in traffic), requiring a rapid warning to avoid missing instantaneous anomalies; if the cumulative deviation value Smedium(t) of the medium window is triggered, it indicates that the anomaly has been ongoing for some time and the drift speed is moderate, requiring confirmation of the anomaly trend in conjunction with the fast window results to balance sensitivity and stability; if the cumulative deviation value Sslow(t) of the slow window is triggered, it indicates that the anomaly is a long-term, slow drift (such as a low-rate DDoS attack), requiring a high-priority response (such as rate limiting or blocking) to prevent the slowly accumulating anomaly from having a continuous impact on the system, so as to achieve accurate capture of drifts at different speeds;

[0091] Then, the corresponding abnormal feature data are processed by three detectors respectively, and the output value range is: Normalized risk data The sum can be set to a value of 1. Decision results The first detector normalizes and performs binary decision processing on global anomaly features to obtain first risk data and a first decision result; the second detector normalizes and performs binary decision processing on contextual anomaly features to obtain second risk data and a second decision result; the third detector normalizes and performs binary decision processing on collective anomaly features to obtain third risk data and a third decision result; based on the first risk data and first weight, the second risk data and second weight, and the third risk data and third weight, the final risk data of the operational data is determined. ;

[0092]

[0093] In the formula, As weight, For risk data; where m=1,2,3;

[0094] Based on the first decision result and first weight, the second decision result and second weight, the third decision result and third weight, and the decision threshold, the final decision result of the operational data is determined. ;

[0095]

[0096] In the formula, , For the decision outcome, I() is the indicator function, and T is the decision threshold;

[0097] Based on the final risk data and the final decision results, anomaly detection data for the operational data are determined. Specifically, if the final decision result is 1, the data is determined to be abnormal; if the final decision result is 0, the data is determined to be normal. If the final risk level is between 0.0 and 0.3, the anomaly risk is determined to be low; if the final risk level is between 0.3 and 0.6, the anomaly risk is determined to be low-to-medium; if the final risk level is between 0.6 and 0.8, the anomaly risk is determined to be high-to-medium; and if the final risk level is between 0.8 and 1.0, the anomaly risk is determined to be the highest level.

[0098] Step 140: Based on the anomaly detection data, determine the corresponding response measures.

[0099] In this embodiment of the application, the response measures corresponding to the abnormal detection data are specifically determined as follows: when the final decision result in the abnormal detection data is determined to be abnormal, and the final risk data in the abnormal detection data is at a first threshold, the response measure is blocking; when the final decision result in the abnormal detection data is determined to be abnormal, and the final risk data in the abnormal detection data is at a second threshold, the response measure is flow limiting; when the final decision result in the abnormal detection data is determined to be abnormal, and the final risk data in the abnormal detection data is at a third threshold, the response measure is early warning; when the final decision result in the abnormal detection data is determined to be abnormal, and the final risk data in the abnormal detection data is at a fourth threshold, the response measure is monitoring only.

[0100] Specifically, if the final decision result is 1 and the final risk level is between 0.0 and 0.3, then a monitoring-only operation is performed; if the final decision result is 1 and the final risk level is between 0.3 and 0.6, then an early warning operation is performed; if the final decision result is 1 and the final risk level is between 0.6 and 0.8, then a rate limiting operation is performed; if the final decision result is 1 and the final risk level is between 0.8 and 1.0, then a blocking operation is performed. This is to trigger different levels of response measures (such as monitoring, alarms, traffic limiting, and blocking) based on the anomaly detection data, achieving a balance between defense flexibility and business continuity.

[0101] In this embodiment of the application, after determining the response measures corresponding to the anomaly detection data based on the anomaly detection data, the method further includes: receiving feedback information; wherein the feedback information is obtained by labeling the anomaly detection data that issued the alarm; and updating the weights and thresholds in the dynamic baseline model and the multi-dimensional anomaly detection model based on the feedback information.

[0102] In this embodiment, after detecting and identifying abnormal data and triggering alarms through a multi-dimensional anomaly detection model, the detected anomaly detection data is sent to a professional analyst. The professional analyst performs manual analysis on the anomaly detection data and labels it, such as attack, false alarm, and / or new threat, and provides feedback on the labeled information. Upon receiving the feedback information (which includes anomaly detection data and labels), the weights and thresholds in the dynamic baseline model and the multi-dimensional anomaly detection model are updated based on the feedback information to ensure that each model adapts to business changes and real anomaly scenarios.

[0103] The adaptive risk defense method provided in this application integrates STL time series decomposition, EWMA conditional mean prediction, and GARCH conditional variance prediction to obtain a dynamic baseline with time-varying mean and volatility. This eliminates the incompatibility of static thresholds with dynamic systems, ensuring that the baseline can be dynamically adjusted with business load and time. By constructing a multi-algorithm detection model including isolated forest, local outlier factor, and CUSUM, and using weighted fusion decision to achieve full-spectrum anomaly detection, it balances the limitations of single algorithm detection capabilities and improves detection accuracy and recall. By quantifying the detection results into risk scores and triggering different levels of response measures (such as monitoring, alarms, traffic restrictions, and blocking) based on the scores, it achieves a balance between defense flexibility and business continuity. By collecting analyst feedback and automatic annotation results, it incrementally learns the model parameters (GARCH weights, detection algorithm weights), enabling the dynamic baseline and detection model to continuously adapt to business changes and new attacks, reducing manual maintenance costs.

[0104] This application provides an adaptive risk defense device, see below. Figure 2As shown, the adaptive risk defense device provided in this application embodiment includes:

[0105] Data acquisition module 210 is used to acquire the operating data of the information system;

[0106] The dynamic baseline module 220 is used to predict the dynamic baseline of the operating data using a dynamic baseline model based on the operating data. The dynamic baseline model is as follows: based on the operating data, it determines the trend characteristics, seasonal characteristics, and residual characteristics of the operating data; based on the trend characteristics and residual characteristics, it determines the conditional mean of the operating data; based on the residual characteristics, it determines the conditional variance of the operating data; and based on the conditional mean and conditional variance, it obtains the dynamic baseline at the current time.

[0107] The data detection module 230 is used to determine the anomaly detection data of the running data based on a dynamic baseline and a multi-dimensional anomaly detection model. The multi-dimensional anomaly detection model determines the global point anomaly features of the running data through a global detection sub-model; determines the contextual anomaly features of the running data through a local detection sub-model; determines the collective anomaly features of the running data through a mean detection sub-model; and determines the anomaly detection data of the running data based on the global point anomaly features, contextual anomaly features, and collective anomaly features.

[0108] The exception handling module 240 is used to determine the response measures corresponding to the exception detection data based on the exception detection data.

[0109] In an optional embodiment, the adaptive risk defense device provided in this application further includes:

[0110] The feedback optimization module 250 is used to receive feedback information, which is obtained by labeling the anomaly detection data that issued the alarm. Based on the feedback information, the module updates the weights and thresholds in the dynamic baseline model and the multi-dimensional anomaly detection model.

[0111] It should be noted that the principle of the adaptive risk defense device provided in this application embodiment to solve the technical problem is similar to that of the adaptive risk defense method provided in this application embodiment. Therefore, the implementation of the adaptive risk defense device provided in this application embodiment can refer to the implementation of the adaptive risk defense method provided in this application embodiment, and the repeated parts will not be described again.

[0112] After introducing the adaptive risk defense method and apparatus provided in the embodiments of this application, the electronic device provided in the embodiments of this application will be briefly introduced next.

[0113] See Figure 3As shown, the electronic device 500 provided in this application embodiment includes at least a processor 501, a memory 502, and a computer program stored in the memory 502 and executable on the processor 501. When the processor 501 executes the computer program, it implements the adaptive risk defense method provided in this application embodiment.

[0114] The electronic device 500 provided in this application embodiment may further include a bus 503 connecting different components (including processor 501 and memory 502). The bus 503 represents one or more types of bus structures, including memory bus, peripheral bus, local area bus, etc.

[0115] Memory 502 may include a readable storage medium in the form of volatile memory, such as random access memory (RAM) 5021 and / or cache memory 5022, and may further include read-only memory (ROM) 5023. Memory 502 may also include a program tool 5025 having a set (at least one) of program modules 5024, including but not limited to an operating subsystem, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0116] Processor 501 can be a single processing element or a collective term for multiple processing elements. For example, processor 501 can be a central processing unit (CPU) or one or more integrated circuits configured to implement the adaptive risk defense method provided in the embodiments of this application. Specifically, processor 501 can be a general-purpose processor, including but not limited to CPUs, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0117] Electronic device 500 can communicate with one or more external devices 504 (e.g., keyboard, remote control, etc.), and also with one or more devices that enable a user to interact with electronic device 500 (e.g., mobile phone, computer, etc.), and / or with devices that enable electronic device 500 to communicate with one or more other electronic devices 500 (e.g., router, modem, etc.). This communication can be performed through input / output (I / O) interface 505. Furthermore, electronic device 500 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) through network adapter 506. Figure 3 As shown, network adapter 506 communicates with other modules of electronic device 500 via bus 503. It should be understood that, although... Figure 3 As not shown, other hardware and / or software modules may be used in conjunction with the electronic device 500, including but not limited to microcode, device drivers, redundant processors, external disk drive arrays, Redundant Arrays of Independent Disks (RAID) subsystems, tape drives, and data backup storage subsystems.

[0118] It should be noted that, Figure 3 The electronic device 500 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0119] The following describes the computer-readable storage medium provided in the embodiments of this application. The computer-readable storage medium provided in the embodiments of this application stores computer instructions, which, when executed by a processor, implement the adaptive risk defense method provided in the embodiments of this application. Specifically, the computer instructions can be built into or installed in the processor, so that the processor can implement the adaptive risk defense method provided in the embodiments of this application by executing the built-in or installed computer instructions.

[0120] In addition, the adaptive risk defense method provided in this application embodiment can also be implemented as a computer program product, which includes program code. The program code implements the adaptive risk defense method provided in this application embodiment when it runs on a processor.

[0121] The computer program product provided in this application embodiment may employ one or more computer-readable storage media, which may be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination thereof. Specifically, more specific examples (a non-exhaustive list) of computer-readable storage media include electrical connections with one or more wires, portable disks, hard disks, RAM, ROM, erasable programmable read-only memory (EPROM), optical fibers, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0122] The computer program product provided in this application embodiment can be a CD-ROM and include program code, and can also run on electronic devices such as computers. However, the computer program product provided in this application embodiment is not limited thereto. In this application embodiment, the computer-readable storage medium can be any tangible medium that contains or stores program code, which can be used by or in conjunction with an instruction execution system, device, or apparatus.

[0123] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0124] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0125] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0126] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the spirit and scope of the embodiments of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.

Claims

1. An adaptive risk defense method, characterized in that, The method comprises: acquiring operation data of an information system; based on the operation data, predicting a dynamic baseline of the operation data by using a dynamic baseline model; wherein the dynamic baseline model is, based on the operation data, determining trend characteristics, seasonal characteristics and residual characteristics of the operation data; based on the trend characteristics and the residual characteristics, determining a conditional mean of the operation data; based on the residual characteristics, determining a conditional variance of the operation data; based on the conditional mean and the conditional variance, obtaining the dynamic baseline of the current time; wherein predicting the dynamic baseline of the operation data by using the dynamic baseline model comprises: extracting the trend characteristics of the operation data by using a local weighted regression scatter smoothing sub-model, extracting the seasonal characteristics of the operation data by using a cyclic subsequence smoothing sub-model, and determining the residual characteristics based on the operation data, the trend characteristics and the seasonal characteristics; based on the trend characteristics and the residual characteristics, predicting the conditional mean of the operation data at the next time by using an exponential weighted moving average sub-model; based on the residual characteristics, predicting the conditional variance of the operation data at the next time by using a generalized autoregressive conditional heteroscedasticity sub-model; based on the conditional mean and the conditional variance, obtaining the dynamic baseline of the operation data at the current time by using a Gaussian distribution; based on the dynamic baseline, determining abnormal detection data of the operation data by using a multi-dimensional anomaly detection model; wherein the multi-dimensional anomaly detection model is, determining global point anomaly characteristics of the operation data by using a global detection sub-model; determining context anomaly characteristics of the operation data by using a local detection sub-model; determining collective anomaly characteristics of the operation data by using a mean detection sub-model; based on the global point anomaly characteristics, the context anomaly characteristics and the collective anomaly characteristics, determining the abnormal detection data of the operation data; wherein determining the abnormal detection data of the operation data comprises: based on the global point anomaly characteristics, the context anomaly characteristics and the collective anomaly characteristics, determining first risk data and a first decision result of the global point anomaly characteristics, second risk data and a second decision result of the context anomaly characteristics, and third risk data and a third decision result of the collective anomaly characteristics; based on the first risk data and a first weight, the second risk data and a second weight, and the third risk data and a third weight, determining final risk data of the operation data; based on the first decision result and the first weight, the second decision result and the second weight, the third decision result and the third weight, and a decision threshold, determining a final decision result of the operation data; based on the final risk data and the final decision result, determining the abnormal detection data of the operation data; based on the abnormal detection data, determining a response measure corresponding to the abnormal detection data.

2. The adaptive risk defense method of claim 1, wherein, Further comprising: receiving feedback information; wherein the feedback information is obtained by labeling the abnormal detection data that issues an alarm. updating respective weights and thresholds in the dynamic baseline model and the multi-dimensional anomaly detection model based on the feedback information.

3. The adaptive risk defense method of claim 1, wherein, based on the dynamic baseline, adopting a multi-dimensional anomaly detection model to determine anomaly detection data of the operation data, including: determining an average path length of the operation data by randomly selecting features and segmentation points, and determining the global point anomaly feature of the operation data based on the average path length and a normalization factor; determining a local density value of the operation data by K-neighbor, and determining the context anomaly feature of the operation data based on the local density value and a neighbor average local density; determining a multi-window deviation cumulative value of the operation data by the dynamic baseline and multi-window, and determining the collective anomaly feature of the operation data based on the multi-window deviation cumulative value; determining anomaly detection data of the operation data based on the global point anomaly feature, the context anomaly feature and the collective anomaly feature.

4. The adaptive risk defense method of claim 1, wherein, based on the anomaly detection data, determining a response measure corresponding to the anomaly detection data, including: when the final decision result in the anomaly detection data is determined to be abnormal, and the final risk data in the anomaly detection data is in a first threshold, the response measure is blocking; when the final decision result in the anomaly detection data is determined to be abnormal, and the final risk data in the anomaly detection data is in a second threshold, the response measure is flow limiting; when the final decision result in the anomaly detection data is determined to be abnormal, and the final risk data in the anomaly detection data is in a third threshold, the response measure is early warning; when the final decision result in the anomaly detection data is determined to be abnormal, and the final risk data in the anomaly detection data is in a fourth threshold, the response measure is only monitoring.

5. An adaptive risk defense apparatus, comprising: including: a data acquisition module for acquiring operation data of an information system; The dynamic baseline module is configured to predict a dynamic baseline of the operation data based on the operation data by using a dynamic baseline model, wherein the dynamic baseline model is configured to determine a trend feature, a seasonal feature and a residual feature of the operation data based on the operation data, determine a conditional mean of the operation data based on the trend feature and the residual feature, determine a conditional variance of the operation data based on the residual feature, and obtain the dynamic baseline of the operation data at a current time based on the conditional mean and the conditional variance; wherein the dynamic baseline model is configured to predict the dynamic baseline of the operation data by extracting the trend feature of the operation data by using a local weighted regression scatter smoothing sub-model, extracting the seasonal feature of the operation data by using a cyclic subsequence smoothing sub-model, and determining the residual feature based on the operation data, the trend feature and the seasonal feature; predicting the conditional mean of the operation data at a next time based on the trend feature and the residual feature by using an exponential weighted moving average sub-model; predicting the conditional variance of the operation data at the next time based on the residual feature by using a generalized autoregressive conditional heteroscedasticity sub-model; and obtaining the dynamic baseline of the operation data at the current time based on the conditional mean and the conditional variance by using a Gaussian distribution. The data detection module is configured to determine abnormal detection data of the operation data based on the dynamic baseline by using a multi-dimensional abnormal detection model, wherein the multi-dimensional abnormal detection model is configured to determine a global point abnormal feature of the operation data by using a global detection sub-model, determine a context abnormal feature of the operation data by using a local detection sub-model, determine a collective abnormal feature of the operation data by using a mean detection sub-model, and determine the abnormal detection data of the operation data based on the global point abnormal feature, the context abnormal feature and the collective abnormal feature; wherein the multi-dimensional abnormal detection model is configured to determine a first risk data and a first decision result of the global point abnormal feature, a second risk data and a second decision result of the context abnormal feature, and a third risk data and a third decision result of the collective abnormal feature based on the global point abnormal feature, the context abnormal feature and the collective abnormal feature; determine a final risk data of the operation data based on the first risk data and a first weight, the second risk data and a second weight, and the third risk data and a third weight; determine a final decision result of the operation data based on the first decision result and the first weight, the second decision result and the second weight, the third decision result and the third weight, and a decision threshold; and determine the abnormal detection data of the operation data based on the final risk data and the final decision result. The abnormal processing module is configured to determine a response measure corresponding to the abnormal detection data based on the abnormal detection data.

6. The self-adapting defense against risk apparatus of claim 5, wherein, The feedback optimization module is configured to receive feedback information, wherein the feedback information is obtained by labeling the abnormal detection data that issues an alarm. ​ Based on the feedback information, updating respective weights and thresholds in the dynamic baseline model and the multi-dimension anomaly detection model.

7. An electronic device, comprising: The computer program is stored in the memory and executable on the processor, and the processor executes the computer program to implement the adaptive risk defense method according to any one of claims 1 to 4.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are executed by the processor to implement the adaptive risk defense method according to any one of claims 1 to 4.

Images